Learning and Development 2016-17 City of York Council Internal Audit Report

Business Unit: Customer and Corporate Services Responsible Officer: Deputy Chief Executive & Director of Customer & Corporate Services Service Manager: Head of HR & OD Date Issued: 10th January 2017 Status: Final Reference: 19130/012

| Actions | P1 | P2 | P3 | |---------|----|----|----| | Overall Audit Opinion | Substantial Assurance | Summary and Overall Conclusions

Introduction The Workforce Development Unit (WDU) provides learning and development opportunities to the whole of the City of York Council workforce. In addition it also serves individuals and organisations who provide care, support or services to adults and children in York. The WDU offers a variety of learning opportunities to ensure the council develops its staff so that it can keep serving the city and delivering services.

The WDU provided 1,360 courses in 2015/16 attended by 11,800 people with the attendees being evenly split between internal and external customers. The WDU has a net budget of £579k with £108k of funding being received from clients.

Objectives and Scope of the Audit The purpose of this audit was to provide assurance to management that procedures and controls within the system will ensure that:

- There is a wide variety of learning opportunities offered which meet the council's objectives for developing its workforce;
- training programmes are of high quality and as per the specification;
- there is a process to ensure learning resources are booked and authorised appropriately;
- all money is collected from clients promptly and accurately;
- a record is kept of training;
- personal data is stored securely.

Key Findings A wide variety of training courses were available with a dedicated website and brochures that customers could use to book places on training courses. The records of training courses were also kept on a secure system where access was restricted appropriately.

However, the WDU has a reliance on human intervention resulting in areas where there was insufficient evidence to confirm whether the procedures were operating as intended. The process for returning both course registers and evaluation forms is not being monitored effectively which has resulted in forms being missing. If more training courses are to be provided in future then the WDU needs to ensure that the procedures being used can cope with the additional numbers.

Overall Conclusions It was found that the arrangements for managing risk were good with few weaknesses identified. There is an effective control environment in place but scope for further improvements to be made. Our overall opinion of the controls within the system at the time of the audit was that they provided Substantial Assurance. 1 Course Registers and Evaluation forms

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | Registers and training course evaluation forms were not always present nor was there any process to identify training providers who persistently do not provide training courses of the required quality. | Attendance at training courses cannot be confirmed for external customers who should be charged. | | Poor quality training courses that do not deliver the expected outcomes are not being identified. |

Findings

At the start of each training course candidates sign a register to confirm attendance at the course. The register is then returned to the WDU by the training course provider along with evaluation forms, which are completed by attendees of the course. A sample of training courses was taken which showed registers and evaluation forms had not been returned in half of the cases. There was also no record or log being kept which shows which training course providers had not returned course registers or evaluation forms so that the provider could be contacted to return them.

Although issues relating to individual training courses would be taken up by the WDU, there is no consolidation work being done to identify under performing training providers. The evaluation responses for each training course are recorded on a spreadsheet to give an overall evaluation of the training course but no comparisons are made with previous evaluations from training courses that have been carried out by the same training provider. This means that no trends are being identified where providers are not delivering training courses to the required standard.

It was also noted that the data extraction tool which extracted data from course evaluation returns on SDMS onto the spreadsheet was not working correctly which resulted in data from the same form being included in two columns.

Agreed Action 1.1

Once forms are returned to WDU the Business Support hub update the system. A manual record of any missing forms is kept and chased on a regular basis, if, after 4 weeks, a response has not been received then this is passed to one of our Facilitators to follow up. The facilitators will also record any activity on the system so it is easy to identify a course of action.

A comparative look at the evaluations on a quarterly basis will now be produced. This will allow any trends or changes in trends to be identified and acted upon.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------------| | 2 | Business Support Manager | 30th June 2017 |

## 2 Customers with outstanding arrears

| Issue/Control Weakness | Risk | |------------------------|------| | There is no formal process to identify and record customers with large value and long standing arrears in order to potentially block their ability to book places on training courses. | Customers with large value outstanding arrears continue to book places on training courses and in doing incur additional debt which is not paid. |

### Findings

The Customer Accounts team are responsible for raising invoices and recovering outstanding arrears on behalf of the WDU. However, there is no formal process to identify customers with large value outstanding arrears for long periods of time. There is also no way of identifying customers on SDMS who should not be able to book further places on training courses until they have paid their existing outstanding debts.

### Agreed Action 2.1

Our current system does not allow the WDU to block particular customers from booking on to courses. The WDU are currently in the process of identifying and procuring a replacement system and will ensure that this is a requirement of the specification for the new system.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Business Support Manager | 30th June 2017 |

### 3 Workforce Strategy Document

| Issue/Control Weakness | Risk | |------------------------|------| | The Workforce strategy document is now out of date. | The council's plans for developing its workforce are out of date which may result in the council not achieving its corporate objectives. |

### Findings

The Workforce Strategy, which is attached to the council's intranet, covers the period 2012 to 2015 which details the council's policies to develop its workforce in order to achieve its corporate objectives. This document is now out of date with a new version required.

### Agreed Action 3.1

The new document is the 2016 to 2020 People Plan which was approved by the Executive in June, this will need to be uploaded to the intranet so is easily accessible.

| Priority | 3 | |----------|---| | Responsible Officer | Head of Business HR | | Timescale | 31st March 2017 | Audit Opinions and Priorities for Actions

Audit Opinions

Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit.

Our overall audit opinion is based on 5 grades of opinion, as set out below.

| Opinion | Assessment of internal control | |--------------------|------------------------------------------------------------------------------------------------| | High Assurance | Overall, very good management of risk. An effective control environment appears to be in operation. | | Substantial Assurance | Overall, good management of risk with few weaknesses identified. An effective control environment is in operation but there is scope for further improvement in the areas identified. | | Reasonable Assurance | Overall, satisfactory management of risk with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. | | Limited Assurance | Overall, poor management of risk with significant control weaknesses in key areas and major improvements required before an effective control environment will be in operation. | | No Assurance | Overall, there is a fundamental failure in control and risks are not being effectively managed. A number of key areas require substantial improvement to protect the system from error and abuse. |

Priorities for Actions

| Priority | Description | |----------|-----------------------------------------------------------------------------| | Priority 1 | A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. | | Priority 2 | A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. | | Priority 3 | The system objectives are not exposed to significant risk, but the issue merits attention by management. | Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk. Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.